Code Review Skills

A collection of 22 focused code-review and security-audit skills, built to the Agent Skills open standard and packaged as a Claude Code plugin.

Each skill is a deliberate, single-purpose audit you run on demand. These are granular where the bundled /code-review and /security-review are broad. They do deep dive reviews of your code, when you want it to. They started life as the prompts in Claude-Code-Reviewing-Prompts.

What you get

• Spec-compliant skills. Every skill is a folder with a SKILL.md (name + description required, both within the spec’s limits). They work in any tool that implements the Agent Skills standard, not just Claude Code.
• Claude Code extras, layered on top. disable-model-invocation (so these fire only when you ask), allowed-tools, and argument-hint are added as frontmatter. Tools that don’t understand those keys simply ignore them — the skill still works.
• Two ways to install (below): as a Claude Code plugin, or by copying individual skill folders into any agent.

Install as a Claude Code plugin

/plugin marketplace add JeremyMorgan/code-review-skills
/plugin install code-audit@code-audit

Skills then appear under the plugin’s namespace, e.g. /code-audit:solid-principles. Pass a path to scope the review:

/code-audit:secrets-management-audit src/auth

With no argument, each skill reviews the whole codebase. Findings are written to an audits/ folder.

Use standalone (any Agent Skills tool)

Copy any skill folder into your skills directory. No plugin required:

cp -r skills/solid-principles ~/.claude/skills/

Each folder is self-contained, so this works in any agent that follows the Agent Skills spec.

Skills

Code quality

• code-duplication-detection — duplicated and near duplicate code
• code-quality-metrics-standards — complexity and standards compliance
• design-pattern-implementation — pattern usage and fit
• error-handling-resilience — error-handling coverage and recovery
• exception-flow-analysis — exception propagation on critical paths
• initial-software-design-analysis — first-pass architecture review
• readability-and-naming — readability and naming conventions
• resilience-fault-tolerance — failure modes, retries, degradation
• solid-principles — SOLID adherence with concrete fixes
• testing-implementation — test quality and coverage gaps

Security

• api-and-infrastructure — API and infra hardening
• authentication-flow-review — login, sessions, tokens, credentials
• authorization-implementation — access control and privilege flaws
• business-logic-vulnerabilities — workflow bypasses, race conditions